The central element of data protection documentation is the record of processing activities. All activities in which the organisation or company processes personal data are documented here. The creation of the record of processing activities is a one-off effort. Once created, it can be updated on an ongoing basis in the event of changes.

There are now also software solutions (so-called "data protection management systems" or "DSM systems") with which the documentation and maintenance of the processing directory can be carried out completely digitally.

There are no precise specifications for the structure of a processing directory. You will therefore find two different templates below with instructions for completing them, as well as some further information.

Example

• Processing directory of the European Data Protection Supervisor (EDPS). This directory is kept on a website:
  https://edps.europa.eu/ueber/datenschutz-innerhalb-dem-edsb/register-der-verarbeitungen-personenbezogener-daten-beim-edsb_de?records_register%5B0%5D=topics%3A360

Further information

• Step-by-step guide for small businesses from the Data Protection Foundation:
  https://ds-kleinunternehmen.de/schritt-fuer-schritt

• Short paper of the German Data Protection Conference DSK on the implementation of a processing directory:
  https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_1.pdf

Template

• Documentation of individual processing activities with instructions for completion (docx-File)